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Abstract 

Current aircraft engine control logic uses a Min-Max 
control selection structure to prevent the engine from 
exceeding any safety or operational limits during transients 
due to throttle commands. This structure is inherently 
conservative and produces transient responses that are slower 
than necessary. In order to utilize the existing safety margins 
more effectively, a modification to this architecture is 
proposed, referred to as a Conditionally Active (CA) limit 
regulator. This concept uses the existing Min-Max architecture 
with the modification that limit regulators are active only 
when the operating point is close to a particular limit. This 
paper explores the use of CA limit regulators using a publicly 
available commercial aircraft engine simulation. The 
improvement in thrust response while maintaining all 
necessary safety limits is demonstrated in a number of cases. 

Introduction 

The control system in modern commercial aircraft engines 
is designed to operate the engine in a safe manner throughout 
its operating envelope during its on-wing life. This 
challenging objective is typically achieved through the use of 
a Min-Max architecture (Refs. 1 and 2) as shown in Figure 1. 
Each of the physical and operational engine limits of concern 
has a unique regulator associated with it. Each of these 
regulators generates a desired fuel flow rate (Wf) that will 
maintain the limit. The throttle is used as input to either an 
engine pressure ratio (EPR) setpoint regulator or a fan speed 
( Nf) setpoint regulator. The desired fuel flow from the setpoint 
regulator and each of the maximum limit regulators are input 
to a minimum selector. The output of this Min selector and 
each of the minimum limit regulator outputs are input to a 
maximum selector. Thus, the output from the Min-Max 
selector is the fuel flow rate command that ensures that none 
of the operational and safety limits will be violated. 

This architecture, which is typical for today’s commercial 
aircraft engine controllers, is inherently conservative. The 
engine limit regulators are typically designed as simple 
regulators (e.g., Proportional-Integral controllers) and they are 
each independently designed. The Min-Max architecture then 


ensures that the most conservative control input is chosen. A 
limit regulator can become active even when there is no 
immediate danger of reaching the limit. This results in a 
slower engine response than is actually necessary to maintain 
safe operation. Typically, this has not been a problem as this 
conservative design is still able to meet the FAA certification 
requirements for engine response time. Flowever, in 
emergencies, such as the Sioux City crash of United flight 232 
in 1989, this conservative design may prevent the engine from 
achieving the faster response times that might be needed to 
provide adequate flight control (Ref. 3). 

Previous research (Ref. 4) on developing methods to 
enhance the engine response for emergency control has shown 
that this conservative limit protection approach prevents the 
engine from delivering the dynamic response that is actually 
achievable. The authors of Reference 4 were attempting to 
achieve faster engine response by increasing the bandwidth of 
the setpoint controller, using a 90,000 lbf engine simulation as 
the application. Flowever, they found that the turbine 
temperature limit would activate and slow the engine 
response. It was discovered that the temperature limit 
regulator was becoming active even when the actual 
temperature was far from its limit. It is worth noting that while 
a turbine temperature limit is not typically found in 
commercial aircraft engine controller, it is possible that other 
limits become active prematurely and unnecessarily slow the 
engine response. 

More recent research has studied means of avoiding this 
problem by the use of alternative limit protection 
architectures. One recent study investigates the use of Sliding 
Mode controllers as a means of preventing unnecessary limiter 
interventions while ensuring safe performance Reference 5. 
Another recent study investigates the use of a reference 
governor on a linearized engine model Reference 6. Flowever, 
the changes proposed in these studies necessitate a complete 
redesign of the engine controller which will impose challenges 
in terms of verification across the whole operating envelope 
and acceptance by engine control implementers. 

In an effort to maintain the current control architecture 
while reducing this conservatism, a new scheme is proposed 
wherein the engine control limit regulators become active only 
when the variable to be limited is within a specified close 
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Figure 1. — Diagram of the C-MAPSS40k engine control system 
with throttle (PLA) input and Wf command output. The Power 
Management and Protection Logic subsystems are 
highlighted. 

bound of the actual limit value. This paper first presents the 
formulation of this CA limit regulator protection scheme. 
Choosing appropriate bounds for when the limit regulator 
becomes active is then discussed in the context of application 
to an engine simulation. Various aspects of engine operation 
with the baseline Min-Max limit protection and the enhanced 
CA limit protection are evaluated and compared. Conclusions 
from this study and areas that need further investigation are 
then summarized. 

Nomenclature 

a Constant that defines the error bound for a 

conditionally active limiter 

P Constant that defines the error derivative 

bound for a conditionally active limiter 
CA Conditionally Active 

C-MAPSS40k Commercial Modular Aero-Propulsion 

System Simulation 40,000 lbf 
e limit regulator error 

EPR Engine Pressure Ratio 

F„ et Net engine thrust [lbf] 

y Constant that defines an override enable 

for a conditionally active limit regulator 
ISA International Standard Atmosphere 

HPC High Pressure Compressor 

Nc Core Shaft Speed [rpm] 


Nf Fan Shaft Speed [rpm] 

PLA Power Lever Angle [deg] 

Ps3 Combustor Entrance Static Pressure [psi] 

RU Ratio Unit ( WfIPs3 ) [lbm/s/psi] 

SLS Sea-level static flight condition (0 ft altitude, 

Mach 0.0, ISA+0 degrees) 

SM Surge Margin [%] 

AT Controller step size [s] 

Wf Fuel Flow Rate [lbm/s] 

y The measured value of a limited engine parameter 

Tmax The maximum limit of the engine parameter y 

Train The minimum limit of the engine parameter y 

Conditionally Active Limit Regulation 

Consider the generic form of a Min-Max control selection 
scheme as shown in Figure 2. Here, z is the regulated variable 
of interest to provide desired performance, i.e., fan speed or 
EPR in the case of an aircraft gas turbine engine. Output v i is 
to be maintained below a certain maximum value (y i max ) and 
output y 2 is to be maintained above a certain minimum value 
(T 2 min)- For simplicity, y t andy 2 are the only limits considered, 
however the premise extends to an arbitrary number of output 
variables. 

In the above Min-Max selection scheme, the limit regulated 
outputs are constantly being used in the selection of the 
commanded input, u, to the plant. However, such an approach 
is inherently conservative in that the commanded input might 
be limited by one of the limit regulators even if the value of 
the output to be limited is far from its limit. 

Since the purpose of the limit regulator is to ensure that the 
specified limit is not violated, it does not need to be active if 
there is no chance of the limit being reached. The idea behind 
CA limit regulators is to make the limit regulator active in the 
Min-Max selection scheme only when there is a reasonable 
chance that the limit will be reached if the input command 
generated by the setpoint regulator (or another limit regulator) 
is not modified. 

An operational region for a limit regulator to be active in the 
Min-Max selection scheme can then be defined as: Condition 1: 
the variable to be limited is “close” to its limit value, and 
Condition 2: its current rate is such that it will reach the limit 
within a certain period of time with no other changes. In order 
for the limit regulator to be active, both Conditions 1 and 2 must 
be true. 

For the case of a maximum limit variable, yi, the objective 
will be to keep y 1 < v lmax . Condition 1 can then be stated as: 

Ji >(1 — a 1 )*T lmax (1) 

where oil is a design parameter that is non-negative. 
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Figure 2. — A generic Min-Max scheme used to select the input 
to a plant such that the regulated variable, z, tracks z c with 
the constraints that yi does not exceed yl max and y 2 does 
not fall below y 2 min- 



Figure 3. — Plot showing an example yi(t) for which Equation (1) 
is satisfied starting at f A , but Equation (2) isn’t satisfied until 
f B . Therefore, the CA limit regulator would not become active 
until time fe. 


For condition 2, consider the controller update time to be 
AT with the objective to activate the limit regulator if the 
current rate of change of Vy is such that it will reach y lmax in Pj 
time steps. The condition can be stated as 

Tl + * Pi * AT > Jimax (2) 

at 

where Pi is a design parameter that is non-negative. 

An example maximum limited output variable trajectory is 
shown in Figure 3. The output, y u is initially below the limit 
and both Equations (1) and (2) are false. At time t A , y i crosses 
into the region for which Equation (1) is true — it is “close” to 
the limit. Flowever, the slope at point A is too low to intersect 
y imax within Pi time steps (f A ’ > fA+Pi*A7j. At all points 
between A and B the slope still does not exceed the necessary 
threshold. Visually, it does not appear that the trajectory will 
violate the limit. Flowever at point B there is a sudden 
upswing and now Equation (2) is validated (f B ’ < f B +Pi*A7) 
thus the CA limit regulator would become active and act to 
restrict the input to prevent yi from exceeding yj max . 

For the case of a minimum limit variable, y 2 , the objective 
will be to keep y 2 > y 2 min • Conditions 1 and 2 can be 
developed into equations analogous to Equations (1) and (2) 
with non-negative design parameters a 2 and p 2 . 


cause the limit regulator to switch between active and in- 
active. This behavior could result in chatter in the fuel flow 
command. If this chatter is found to occur and negatively 
impact the performance, an additional condition could be 
imposed such as y 1 > (1 - ) * y lmax where yi is a non- 

negative number that is less than ai. This condition would be 
included into the CA activation logic through the following 
Boolean expression: (Conditions 1 and 2) or Condition 3. 
Flowever, this condition is not implemented in this study. 

Defining the maximum limit regulator error as 
e \ = Timax ~ Ji > Equations (1) and (2) can be written as: 

< «, *y, max (5) 


d -e x 

— e, < i — 

dt 1 P[ * AT 


(6) 


With the minimum limit regulator error defined as 
e 2 = y 2 min - y 2 > Equations (3) and (4) can be stated as: 


<?2 ^-<*2*72 min 


( 7 ) 



— <?2 

p 2 *AJ 


( 8 ) 


y 2 - (1 + a 2 ) * J 2 min ( 3 ) 

T2+^T2*p2* A7 ’^3 ; 2min ( 4 ) 

dt 

It is worth noting that when Condition 1 is met (the variable 
is “close” to the limit) that the construction of Condition 2 can 


When implemented in the generic Min-Max selector block 
diagram of Figure 2, the above implementation of the CA limit 
regulator architecture is shown in Figure 4. The switches 
shown on the output of each limit regulator only connect to the 
Max and Min selector blocks when both bounding conditions 
are true — Equations (5) and (6) for the Max limit regulator 
and Equations (7) and (8) for the Min limit regulator. The rest 
of the system shown in Figure 2 remains unchanged. 
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Figure 4. — The generic Min-Max selection scheme modified to 
include conditionally active limit regulators. When both of the 
necessary conditions are true, the regulator output is passed 
to the Min or Max selector block. 


As most control laws are implemented in a digital 
processor, it is necessary to develop discrete-time versions of 
these equations. The discrete version of the maximum limit 
inequalities Equations (5) and (6) is listed below where e[k ] 
refers to the error at the current time index and e[k-Y\ to the 
error at the previous time step. 


e \ \k\ < a* j/, max 


(9) 


-(e x [k]-e { [k- 1])< 


-edk] 
(3, *AT 


( 10 ) 


Also, the designer may find it desirable to use a filtered 
version of e[k\ to reduce noise. For the case of a minimum 
limit, discrete time equations can be developed in a similar 
manner. 

The designer is thus given two parameters which adjust the 
size of the region in which the limiter will be active. For 
parameters which change value quickly a large a and/or (5 may 
be needed to allow the limit regulator to become active early 
enough to arrest the behavior. 

Currently, the authors have not devised an analytical 
approach to determine a and p for an arbitrary limit regulator. 
Flowever, the next section contains an empirical study that 
was done to choose the CA parameters for a particular engine 
simulation. Until an analytical methodology is found, this 
empirical approach should allow for the implementation of 
CA limit regulators in other engines. 


Empirical Method for Choosing 
Conditional Bounds 

Empirically tuning the conditional bounds, a and P, will be 
done one at a time. The derivative term will be disabled and a 
suitable proportional gain chosen. The choice of a will be 


made by selecting a value as small as possible that produces a 
“safe” outcome in the worst-case situation. The derivative 
term will then be tested at various values and the smallest 
value that produces a safe transient will be selected. 

The engine simulation used for the remainder of this work is 
the publicly-available Commercial Modular Aero-Propulsion 
System Simulation 40,000 lbf (C-MAPSS40k) developed by 
NASA Reference 7. This is a simulation of a generic high- 
bypass, twin-spool, commercial aircraft engine in the 
40,000 lbf thrust class. The simulation includes a realistic 
baseline engine controller Reference 1 against which to 
compare the performance with the CA limit regulators. The 
use of this realistic controller allows for any arbitrary throttle 
transient to be simulated. Additionally, it has realistic surge 
margin models that include the impact of engine deterioration, 
changes in compressor tip clearance, and heat transfer between 
the compressor and the casing. C-MAPSS40k also allows for 
studying the effects of engine degradation through 
implementation of a set of adjustable health parameters 
representing performance deterioration within each of the 
major rotating engine components. The simulation is 
constructed to allow the user to choose EPR or fan speed (Nf) 
as the main regulated variable to command thrust changes 
through the throttle. For the purposes of this study, EPR will 
be used as the main regulated variable. 

The Min-Max architecture used in C-MAPSS40k is shown in 
Figure 1. The maximum limit regulators used are: “Nf Max,” 
“ Nc Max,” “Ps3 Max,” and “Accel Limit,” while the two 
minimum limit regulators are “Ps3 Min” and “RU Min.” Many 
of these are straightforward: the fan speed and core speed 
maximum limiters are to prevent over-speed conditions on the 
two shafts; the Ps3 maximum limit prevents combustor over- 
pressurization; the ratio unit (RU), fuel flow rate divided by Ps3, 
minimum limit is used to ensure that lean blow-out conditions do 
not occur and to prevent Low Pressure Compressor surge. The 
Ps3 minimum limit is used to set the idle operating limit. The 
maximum acceleration limit and the minimum ratio unit limit are 
designed to ensure safe engine operation during transients, 
specifically to preserve compressor surge margin. During engine 
acceleration, the High Pressure Compressor (HPC) is likely to 
surge, and the acceleration limit regulator is designed to prevent 
FIPC surge. During engine deceleration, the Low Pressure 
Compressor (LPC) is more likely to surge and the RU limit 
regulator is designed to prevent LPC surge. 

Currently, there is no feasible means of sensing the 
compressor surge margin on an operating engine. Thus the 
acceleration limiter must limit a sensed value that serves as a 
stand-in for surge margin. There are many different ways to do 
this Reference 8. In C-MAPSS40k, the acceleration limiter is 
applied to maintain HPC surge margin. It is implemented by 
limiting the core shaft acceleration based on the current core 
shaft speed. The higher the shaft speed, the higher the allowed 
acceleration. For LPC surge margin, the ratio unit is used as a 
stand-in. Thus the RU limit regulator ensures that a minimum 
Wf/Ps3 is maintained at all time in order to preserve LPC surge 
margin. 
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These particular limits were chosen for the C-MAPSS40k 
controller, but are by no means the only limits which are 
capable of ensuring safe engine operation. For a full 
discussion on the various limiter choices, see Reference 2. 

The process for choosing the bounds for the CA limit 
regulators will be demonstrated for the acceleration limiter 
and then repeated for the rest of the limiters. The purpose of 
the acceleration limiter is to prevent HPC surge. The distance 
from surge is measured by surge margin (SM) where a value 
of zero means that a surge has occurred. In C-MAPSS40k, an 
HPC surge is most likely to occur on a fully deteriorated 
engine during a full throttle burst. 

An initial look at the engine behavior using the baseline 
control law is useful for further understanding the need for 
conditionally active limit regulators. Plotted in Figure 5 are 
the EPR and net engine thrust (F net ) for an idle to full throttle 
transient which starts at 15 s. The engine is fully degraded 
(i.e., the health parameters in the simulation are chosen to 
correspond to an engine at the end of its useful life — worst- 
case scenario) and operating at sea-level static (SLS) flight 
conditions. Figure 5 shows a long delay between the EPR 
command and the response of the engine with baseline 
control. This long delay manifests as a slow response in 
engine thrust. 

In order to understand the reason for the long delay we look 
at the state of the acceleration limit regulator (as shown in 
Fig. 6) during the transient. A value of one indicates that the 
limit regulator is active and overriding the EPR setpoint 
controller fuel flow rate command in order to preserve HPC 
surge margin. It can be seen that the limit regulator is active 
for more than 2 s almost immediately following the start of the 
transient. 

The question is, does the acceleration limit regulator need to 
be active for this period of time? To answer that, the core shaft 
acceleration, which is limited by the acceleration limit, and 
HPC surge margin are plotted in Figure 7. The top plot shows 
the acceleration limit, which for C-MAPSS40k is a limit on 
dNc/dt based on the current core shaft speed, Nc, which is 
represented by the dotted line, as well as the actual dNc/dt 
versus Nc is shown (solid line). The conservative nature of the 
baseline limit regulator can be seen from the significant 
difference between the limit and actual value of the core 
acceleration. Further, when the HPC surge margin is 
examined, there is a significant amount of transient surge 
margin (12 percent) available. Thus, the acceleration limit 
regulator does not need to be active for as long as it is, 
meaning that the transient thrust response is being slowed 
because of unneeded activation of the acceleration limit 
regulator. To improve the response we can use an 
appropriately tuned conditionally active limit regulator. 




time [s] 

Figure 5. — EPR and thrust responses to a full throttle change at 
15 s at SLS flight conditions with a fully deteriorated engine. 



14 15 16 17 18 19 20 

time [s] 


Figure 6. — Acceleration limit regulator state during a SLS full- 
throttle burst at 15 s with a fully deteriorated engine. 




time [s] 


Figure 7. — Impact of the acceleration limiter during a SLS full- 
throttle burst at 15 s for a baseline controller. 
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To determine an acceptable value of a for a specific limit 
regulator, the error rate limit condition is “ignored” and only 
Condition 1 is necessary for activation of the CA limit regulator. 
Thus, to determine an appropriate value of a, only the criterion 
associated with Equation (5) or Equation (7) is considered 
sufficient to activate that particular regulator. As an example, 
for the case of the acceleration limiter, various values of a are 
tested for the impact on being able to stay within the ELPC surge 
limit. Note that “ignoring” the error rate limit condition is 
analogous to setting P to infinity in Equation (6) or 
Equation (8). The HPC surge margin for various values of a 
with the fully deteriorated engine and the throttle command as 
before is plotted in Figure 8. Here all values of a less than 0.75 
result in the CA limit regulator not being able to prevent HPC 
surge. Note that while the remaining surge margin with a = 0.75 
is small (approximately 2 percent), it is considered sufficient as 
it is greater than zero. This is because the C-MAPSS40k 
simulation includes transient surge margin models that take into 
account engine deterioration, changes in compressor tip 
clearance, heating effects, and transient operation. In an actual 
engine design, the amount of remaining surge margin would 
need to be higher to account for engine -to-engine variation, inlet 
distortion effects, and modeling uncertainties Reference 9. 

With the value of a fixed at 0.75, the effect of error rate on 
the limit regulator being active is considered as P is varied. 
Based on how P is defined, the larger the value of P, the more 
sensitive the limiter activation will be to small deviations from 



time [s] 

Figure 8. — HPC surge margin for various choices of a on the 
acceleration limiter (P fixed at infinity). The test case used 
here is a full-throttle burst (at 15 s) at SLS conditions with a 
fully deteriorated engine. 


the limit. In Figure 9 the impact of changing P on the HPC 
surge margin is shown. Note that as P is increased the closer it 
follows the P = oo curve. The choice of P = 30 produces a safe 
transient; increasing the value any further only serves to make 
the limiter too sensitive to noise or other disturbances. 

Although performance can be improved by adjusting the 
acceleration schedule itself, doing so will increase the risk of 
surge under extreme conditions. The acceleration schedule is 
designed to ensure that adequate surge margin will be 
maintained under all allowable operating conditions as long as 
the core shaft acceleration limit is not exceeded. So the CA 
limit regulator provides the capability to achieve improved 
performance by allowing the engine to operate closer to the 
acceleration limit that guarantees adequate surge margin. 

This process of determining the limit activation parameters a 
and P is then repeated for each of the other engine limit 
regulators. This results in the choice of parameter values as 
shown in Table 1. 



time [s] 

Figure 9. — HPC surge margin for various choices of p on the 
acceleration limiter (a fixed at 0.75). The test case used here 
is a full-throttle burst (at 15 s) at SLS conditions with a fully 
deteriorated engine. 


TABLE 1.— CONSTANTS CHOSEN FOR THE 
FIVE CONDITIONALLY ACTIVE LIMITERS 
IN C-MAPSS40K 


Limiter 

a 

P 

Accel 

0.75 

30 

Nf max 

0.10 

20 

Nc max 

0.20 

20 

Ps3 max 

0.20 

20 

Ps3 min 

0.20 

20 
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Engine Performance With Conditionally 
Active Limit Regulators 

To determine the effectiveness of the conditionally active 
limit regulators on the engine response, three situations are 
evaluated: (1) a case where a transient limit regulator is 
necessary to ensure safe operation, (2) a case where a steady- 
state limit regulator is necessary to ensure safe operation, and 
(3) a case where a limit regulator becomes active 
unnecessarily during a transient. 

During testing it was discovered that the C-MAPSS40k 
EPR setpoints are very conservative and, during normal 
operation, only the acceleration limiter is typically 
encountered. Future versions of the simulation will address 
this by developing a more aggressive EPR setpoint schedule in 
which the limiters act to bound the envelope of operation. For 
the purposes of this study, case 1 will evaluate the 
performance of the acceleration limiter while the core speed 
limiter will be used to evaluate both cases 2 and 3. 

To evaluate case 1, the previous study of a full throttle burst 
at sea-level static conditions is examined in more detail. A 
step throttle change is commanded at 15 s to an engine with 
the baseline control law and one in which the conditionally 
active limiters are installed. The engine is fully degraded to 
test a worst-case scenario. 

The throttle change is commanded internally as an EPR 
command as shown in Figure 10 for both the baseline control 
law and the controller utilizing CA limit regulators. The 
90 percent rise time for the baseline case is 3.47 s compared to 
2.79 s for the case with the CA limit regulators — a reduction 
of nearly 20 percent. This corresponds with the finding in 
Figure 11 that the baseline acceleration limit regulator is 
active for 2.28 s, whereas the CA limit regulator is only active 
for a total of 0.54 s during two periods. 

Examining the FIPC surge margin (Fig. 12) for both cases 
highlights the fact that in the baseline case, the engine 
controller behaves in a conservative (surge margin is much 
greater than zero during the transient) manner. The use of the 
conditionally active limiters reduces this conservatism while 
maintaining a positive surge margin. Additionally, the core 
shaft acceleration versus core shaft speed is plotted in 
Figure 12. Again, the inherent conservatism of the baseline 
limiter can be seen. This conservatism is removed when the 
CA limiter is used, resulting in much higher accelerations, and 
thus faster engine response. 

In addition to studying the fully deteriorated engine, the 
same test was conducted with a new engine. The results are 
nearly identical to those shown in Figures 10 to 12 with the 
single exception that the HPC surge margin is approximately 
3 percent higher for all cases when using a new engine. Due to 
the similar nature of the results, the plots are not included in 
this paper. 

Case 2 studies the behavior of the engine when a steady- 
state limit, such as a core shaft speed limit, is encountered. For 
this case, a flight condition of 10,000 ft, Mach 0.8, and 
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Figure 10. — EPR and thrust responses to a full throttle change at 
15 s at SLS flight conditions with a fully deteriorated engine. 
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Figure 1 1 . — Acceleration limit regulator state during a SLS full- 
throttle burst at 15 s with a fully deteriorated engine for both 
baseline and CA limiters. 
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Figure 12. — Impact of the acceleration limiter during a SLS full- 
throttle burst at 15 s for a baseline controller and a controller 
with CA limiters. 
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Figure 13. — EPR and net thrust generated by engine during a 
full throttle transient at 15 s (10,000 ft, Mach 0.8, ISA+50 R) 
fora baseline controller and controller with CA limiters. 

ISA+50 R is used. Again, an idle to full throttle transient is 
executed with the baseline control system and with the 
conditionally active limiters. For this case, the engine is 
considered to be new — that is all health parameter deviations 
are set to zero to indicate no deterioration. 

The EPR and net thrust responses with the baseline control 
and the CA limit regulators are shown in Figure 13. The 
benefit of using the CA limit regulator is apparent from the 
results in Figure 13. In this case, the 90 percent rise time is 
reduced from 5.05 to 2.68 s. Also, it should be noted that there 
is a steady-state EPR error of 0.004 which cannot be seen in 
the plot at this scale. This error is due to the fact that the core 
speed limit regulator is active and preventing the EPR setpoint 
from being attained. 

The fact that the core shaft speed hits the limit and remains 
there after the transient is shown in Figure 14. Shown are the 
core shaft speed responses as well as the core speed limit. It 
should be noted that the core speed limit is the same for both 
configurations. It can be seen that the CA limit regulator case 
reaches the limit much faster than the baseline case. For both 
cases, the core shaft speed limit is maintained and there are no 
oscillations. 

To examine the impact of the CA limiter, the state of the Nc 
max limiter and Accel limiter are plotted along with the state 
of the EPR setpoint controller (Fig. 15). Due to the nature of 
the Min-Max architecture, only one of these can be active at 
any given time. In the baseline case, the EPR setpoint 
controller drives the transient for approximately the first 1 .2 s 
and then the core speed limiter takes over. Note that at this 
point, the core speed is only 10,860 rpm while the limit is 
12,200 rpm. By comparison, with the CA limiters, the Nc max 
limiter does not become active until 5 s after the transient 
when the core speed is approximately 4.0 rpm below the limit. 
There is some chatter in the state of Nc max limit regulator as 
the changing control action results in the error rate criteria, 
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Figure 14. — Core shaft speed and limit for a full throttle burst at 
15 s (10,000 ft, Mach 0.8, ISA+50 R). 
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Figure 15. — State of the core shaft speed limiter, acceleration 
limiter, and EPR setpoint controller during a full throttle burst 
at 15 s (10,000 ft, Mach 0.8, ISA+50 R). 

Equation (6), becoming false, then true as the EPR setpoint 
regulator assumes control. While there are no observed 
negative effects of this chatter, some hysteresis can be added 
to the CA logic to smooth out the control action. 

Case 3 is evaluated in which a steady-state limiter is 
unnecessarily active for the baseline controller. This is 
analogous to the temperature limit prematurely limiting the 
response in the initial NASA study Reference 4 discussed in the 
introduction. Here, the test is conducted at a flight condition of 
15,000 ft, Mach 0.8, and ISA+50 R with a new engine. 

The EPR and net generated thrust are shown for the baseline 
controller and controller with CA limit regulators in Figure 16. 
There is a small improvement in engine response: the 
90 percent rise time decreases from 3.22 to 2.95 s 
(an 8.4 percent reduction). 
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Figure 16. — EPR and net thrust generated by engine during a 
full throttle transient at 15 s (15,000 ft, Mach 0.8, ISA+50 R) 
fora baseline controller and controller with CA limiters. 
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Figure 17. — Core shaft speed and limit for the baseline 
controller and controller with CA limiters for a full throttle 
burst at 15 s (15,000 ft, Mach 0.8, ISA+50 R). 

The core shaft speeds for both controller configurations are 
plotted in Figure 17 along with the core speed limit. It is 
apparent that in both cases the physical limit is never 
encountered during the transient or at the new operating point. 
Thus, the core speed limit regulator has no need to become 
active. 

Figure 18 shows the state of the Nc max limiter, Accel 
limiter, and the state of the EPR setpoint controller for the two 
controller configurations. When using the baseline controller, 
the Nc max limiter is indeed active (for 0.66 s). When the CA 
limiters are used, the core speed limit regulator never becomes 
active. Additionally, the amount of time spent on the 
acceleration limiter is greatly reduced when using the CA 
limiters (0.19 s compared to 0.53 s for the baseline). 
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Figure 18. — State of the core shaft speed limiter, acceleration 
limiter, and EPR setpoint controller during a full throttle burst 
at 15 s (15,000 ft, Mach 0.8, ISA+50 R). 

In the three cases evaluated, the engine controller using CA 
limit regulators has been shown to result in faster engine 
response while ensuring engine safety. The improved 
performance is attained by eliminating unnecessary limit 
regulator activations and by utilizing more of the available 
safety margins. These cases were used to demonstrate the 
benefits of using CA limit regulators. While no negative 
impacts of the CA limit regulator were observed for these 
cases, a complete validation of the CA limit regulator 
architecture would be required just as was done for the 
baseline control design. 



Conclusions 

The concept of using CA limit regulators in the Min-Max 
architecture of typical engine control laws was introduced. The 
CA architecture in the Min-Max scheme only activates the limit 
regulators when the operating point is within a certain bound of 
the limit and approaching the limit at a faster than prescribed 
rate. This is unlike the typical approach where the limit 
regulators can become inadvertently activated, thereby limiting 
the system response time. The selection of the bounds for the 
CA limit regulator architecture was demonstrated using a 
publicly available detailed dynamic simulation of a commercial 
aircraft engine. The results presented in this paper showed that 
by properly choosing the parameters that activate the CA limit 
regulators, the engine response can be improved while 
preserving all necessary safety limits. It should be noted that the 
CA limiters require tuning and need to be fully evaluated under 
realistic situations (such as sensor noise and engine 
deterioration). While the bounds for the CA limit regulators 
were empirically determined in this study, research needs to be 
done to develop a more rigorous analytical approach to provide 
guidelines for the selection of these bounds. 
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